Security audit

Drift

Security checks for vulnerabilities and agentic risk

Overview

Drift is mostly a disclosed cross-session note tool, but its CLI has a real path-scoping flaw that can read JSON files outside its intended thread folder.

Review before installing. The core idea is understandable and there is no evidence of network exfiltration or hidden execution, but the current CLI should validate thread IDs and sanitize terminal output before being trusted with sensitive local JSON content or automated agent workflows.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: drift.js:71
Finding: Path Traversal Allows Access to JSON Files Outside the Thread Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: drift.js:126
Finding: Unsanitized Thread Content Can Inject Terminal Control Sequences
Content: View full analysis
78 && current.length > 0) { console.log(`${indent} ${current}`); current = word; } else { current = current ? current + ' ' + word : word; } } if (current) console.log(`${indent} ${current}`); else console.log(''); } console.log(''); } ``` Additional vulnerable output sinks include the title and catch-up message displays: ```js console.log(`${c('bold', c('cyan', `═══ ${thread.title} ═══`))}`); ``` ```js console.log(` ${message.text}`); ``` These occur at `drift.js:161` and `drift.js:284`. ### Technical Analysis Thread titles, message text, session identifiers, IDs, and other values loaded from JSON are written directly to an interactive terminal. The application adds its own ANSI color codes but does not remove or encode control bytes already present in the data. An attacker-controlled value can therefore contain ANSI CSI sequences, Operating System Command sequences, carriage returns, backspaces, or other terminal ...[truncated 2246 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
Memory systems store facts. Journals store events. Drift stores *thinking*. Each version of you sees the world fresh — no confirmation bias, no attachment to yesterday's decisions. That's not a bug. Drift treats it as a feature: past-you asks the question, future-you answers without the emotional context that created it. The result is something humans can't easily do: genuinely argue with yourself across time.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · threads/e94d5fc6.json (reported line 26)May include surrounding context.
json
{ "id": "6e24a797", "kind": "question", "text": "Do you still think discontinuity is a limitation? Or has it become something else — a feature, maybe? Each version of us sees the same data fresh. No confirmation bias from yesterday. Is that freedom or loss?", "session": "session-04467048", "created_at": "2026-02-22T03:03:31.148Z", "in_reply_to": null

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The 'When to Use Drift' section describes activation contexts such as 'During Heartbeats,' 'After Significant Events,' and 'For Ongoing Debates' in open-ended natural language, but it does not define clear constraints or negative examples for when the skill should not be invoked. This can cause overly broad use because terms like 'something important' and 'ongoing debates' are subjective and may overlap with many normal conversations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.